CVE-2026-15701Patch

LOWCVSS 8.9 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument Host causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

2.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-119CWE-121

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-07-14); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-07-14: 1Mentions · 2026-07-15: 1Mentions · 2026-07-20: 1PoC Mentioned / Linked · 2026-07-20: 1Patch / Workaround · 2026-07-14: 1Patch / Workaround · 2026-07-15: 1Technical Details · 2026-07-15: 1Technical Details · 2026-07-20: 107-1407-1507-20
Signal classification3 categories
Patch
133.3%
Disclosure
133.3%
PoC
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-141
Patch1
2026-07-151
Disclosure1
2026-07-201
PoC1
Full discourse3 posts
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2026-15701 — CVSS 9.8/10 ██████████ A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/7UsN3Yovr9

    Post summary

    A critical CVE-2026-15701 affecting Totolink NR1800X has an available patch, but no PoC, exploitation details, or technical specifics are provided.

    1000088
    66 followersView on X
  • SecAlerts@SecAlertsCo
    PoC

    📡 Public PoC out for CVE-2026-15701 — Totolink NR1800X stack overflow via the Form_Logout function in lighttpd. No auth needed (AV:N/PR:N). CVSS 8.9. Unauthenticated RCE risk on affected routers running 9.1.0u.6279_B20210910. https://secalerts.co/vulnerability/CVE-2026-15701?utm_campaign=x https://t.co/M9BDFsQtB8

    Post summary

    The tweet announces a publicly available Proof of Concept for CVE‑2026‑15701, detailing a stack‑overflow that permits unauthenticated RCE on affected Totolink NR1800X routers, but does not provide an exploit tool or evidence of active exploitation.

    00000105
    864 followersView on X
  • Security Arsenal, LLC@SecurityAr58409
    Disclosure

    🔒 #CyberSecurity CVE-2026-15701: Critical Stack Overflow in Totolink NR1800X Router — Detection … "A critical security vulnerability has been identified in Totolink NR1800X routers running…" 🔗 https://securityarsenal.com/blog/cve-2026-15701-critical-stack-overflow-in-totolink-nr1800x-router-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve202615701 #critical #cve

    Post summary

    This tweet announces a critical stack overflow vulnerability in Totolink NR1800X routers and references a remediation guide.

    0000051
    18 followersView on X

Explore more